This SDK facilitates writing plugins for Falco or application using Falcosecurity's libs.

Before using this SDK, review the developer's guide which fully documents the API and provides best practices for writing plugins. The developer's guide includes a walkthrough of a plugin written in Go that uses this package.

For a quick start, you can refer to the provided examples:

• plugin with field extraction
• plugin with event sourcing
• plugin with both event sourcing and field extraction

When ready to release your plugin, make sure to register the plugin with the Falcosecurity organization by creating a PR to the falcosecurity/plugins respository with details on the new plugin. This ensures that a given ID is used by exactly one plugin with event sourcing capability, and allows authors of plugins with field extraction capability to coordinate about event source formats.

To get involved with The Falco Project please visit the community repository to find more.

How to reach out?

• Join the #falco channel on the Kubernetes Slack
• Join the Falco mailing list

See the CONTRIBUTING.md.

A third party security audit was performed by Cure53, you can see the full report here.

Please report security vulnerabilities following the community process documented here.

This project is licensed to you under the Apache 2.0 open source license.